fa90312f50c7a4f961ac8f802ee2e2cf3d559f0c38ea65cc1f03f8d830265472

Analysis

max time kernel
149s
max time network
158s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
27/09/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Instagramsrc.apk
Size

5.5MB
MD5

74aad7d19cb878a536ef6522f53f337b
SHA1

80aa95eb50058ce57c6466714c717f160df28093
SHA256

fa90312f50c7a4f961ac8f802ee2e2cf3d559f0c38ea65cc1f03f8d830265472
SHA512

89db44002c960a38e9e0853cae9073212c1e106aba26017dd2f15d4029814bed49710f1c322e66a2dee9c6bf0bab3d7309ed2cf11fe71e1c76f885047c7b8eb1
SSDEEP

98304:NwubXW62AALy6GqYZpcQb788aGg82Qr9pzbuV7zphCIJaL31C8UofrFF3NP6a:NrXZJ6nicQHNaf8/IXrJaD1T3V6a

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	sigma.male
/data/local/xbin/su	sigma.male
/system/sd/xbin/su	sigma.male
/system/bin/failsafe/su	sigma.male
/sbin/su	sigma.male
/system/bin/su	sigma.male
/data/local/bin/su	sigma.male
/data/local/su	sigma.male
/system/app/Superuser.apk	sigma.male

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	sigma.male

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	sigma.male

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	sigma.male

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	sigma.male

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	sigma.male

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	sigma.male

sigma.male
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4966

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Android/data/sigma.male/files/panel.txt

Filesize
19B

MD5
6e0075dcc0b7ac222bea767743b61a33

SHA1
44b3eaebc17568ca6e120747fef61521137068d9

SHA256
d0d1b610858419980e61586967769ed1bf001756aacbd5e00518b3b0eb83a402

SHA512
9950d09e464f74889ae85d70e72e57197b8a2713518bb7901b2c7b6e1ae51dc7e53547b2865f0226bfcc3bd5ea530453298512f8ecbc7b790da3339b5e05cf42

Download Submit
/storage/emulated/0/Android/data/sigma.male/files/uid.txt

Filesize
8B

MD5
918d08a9353d9f20142044e566b27c91

SHA1
6ec0464ff797c325b14b22a93e43e4f76edd0b16

SHA256
8be6a2ded3cf760c6bdd63e25af74384d74517a795e8799113ceb8c9e19cf2ab

SHA512
4c1defadcc865bbf08be8d83c9cfe30e554d2a8b8320b702c6588a4c8769e01c8f30065cc0c33ffe8b2a93615a9a2ac4a3c6f2dda010bcbddd5d461c5061a677

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads